Sigma detection rules, expert-reviewed

Possible GoldFactory GoldPickaxe Mobile Trojan C2 API Calls

This rule detects requests to the GoldFactory API paths such as savevideo2 savesms getfrpconfig and getBPackageUrl which the GoldPickaxe and GoldDigger mobile trojans use for command and control. These endpoints exfiltrate victim facial video, SMS messages and fetch reverse proxy configuration. Detecting them exposes devices harvesting biometric and financial data for the operators.

Possible Godfather Android Banking Trojan C2 Endpoints

This rule detects HTTP requests to the fafa.php sender_new.php and mp4_recorder.php endpoints which are the command and control and data collection URIs of the Godfather Android banking trojan. These paths deliver injection targets and receive stolen credentials, SMS and screen recordings. Detecting them on the network surfaces infected devices communicating with Godfather infrastructure.

Possible Telegram Bot API Command and Control Traffic

This rule detects requests to the Telegram Bot API sendDocument and getUpdates methods which the Dark Pink APT uses to exfiltrate stolen files and receive commands through api.telegram.org. Routing C2 over a trusted messaging service blends malicious traffic with legitimate flows. It matters because it can reveal data theft hidden inside allowed cloud services.

Possible Cobalt Strike Beacon via Default Malleable Profile URIs

This rule detects HTTP requests to the /dpixel and /submit.php URIs which correspond to default Cobalt Strike Malleable C2 profile paths observed in the ColunmTK APT41 intrusions. The GET and POST traffic carries encoded beacon check-ins and task results. Detecting these paths surfaces command and control that operators forgot to customize.

Possible Lazarus C2 Beacon to Uncommon Port 1224 Loader Endpoints

This rule detects HTTP requests to the loader endpoints /pdown and /client on the non-standard port 1224 which are the command and control URIs used by the Lazarus Contagious Interview Python backdoors. The endpoints deliver downloaders and receive collected data. Detecting them exposes active C2 communication from a compromised host.

Suspicious SonicWall Access With Anomalous Chrome Linux User Agent via Webserver

This rule detects requests to SonicWall SSL-VPN and login endpoints that carry an automated-tool signature combining a Chrome 119 on Linux user agent with the campaign target paths. The reconnaissance campaign against SonicWall firewalls presents this consistent Chrome Linux user agent while probing management endpoints from commercial proxy infrastructure. Correlating the anomalous user agent with SonicWall endpoints surfaces scripted scanning that generic path-only detection may miss.

Suspicious SonicWall SSL-VPN Reconnaissance Endpoints via Webserver

This rule detects HTTP requests to SonicWall SSL-VPN and management endpoints characteristic of automated reconnaissance, including /api/sonicos/is-sslvpn-enabled and /sonicui/7/login/. An active campaign delivered through commercial proxy infrastructure enumerates these endpoints to identify exploitable SonicWall firewalls before attempting credential attacks or exploitation. Detecting this enumeration lets defenders identify and block scanning infrastructure early.

Suspicious BeyondTrust Remote Support Probing of nw Endpoint via Webserver

This rule detects HTTP or WebSocket requests to the /nw endpoint on BeyondTrust Remote Support or Privileged Remote Access appliances, which is the reconnaissance and exploitation surface for CVE-2026-1731. Threat actors probe this endpoint to fingerprint and attack internet-facing BeyondTrust deployments prior to remote code execution. Early detection of this probing lets defenders block scanning infrastructure before exploitation succeeds.

Possible Ivanti EPMM In-Memory Java Webshell Access via mifs 403.jsp

This rule detects inbound requests to the /mifs/403.jsp path on Ivanti Endpoint Manager Mobile, the location of an in-memory Java webshell planted during active exploitation. Access to this path indicates post-exploitation command-and-control against EPMM appliances traced to a single bulletproof-hosted IP.

Possible FortiWeb Path-Traversal Authentication Bypass Exploitation CVE-2025-64446

This rule detects inbound POST requests containing a path-traversal sequence that reaches the FortiWeb fwbcgi CGI endpoint through the cmdb admin API, matching the authentication-bypass exploitation of CVE-2025-64446 observed in the wild. Successful exploitation lets an unauthenticated attacker create administrative accounts and run privileged commands on the appliance.

Suspicious Access to Spring Boot Actuator Heapdump Endpoint

This rule detects inbound HTTP requests to the Spring Boot Actuator /heapdump endpoint, which exposes a full JVM memory dump that can leak passwords and secrets. Threat actors abused this against the TeleMessage SGNL Signal-based messaging clone via CVE-2025-48927 during active reconnaissance and exploitation. Successful access lets attackers harvest credentials directly from process memory.

Possible FDMTP Implant C2 Cluster Registration via HTTP (via proxy)

This rule detects the QuickFox FDMTP implant contacting its command and control cluster using a distinctive registration request. The implant issues a GetCluster request carrying the DotNet-TcpFDMTP protocol tag to obtain live C2 nodes. This URI pattern is unique to the FDMTP framework.

Possible TrickBot Anchor DNS C2 Registration via HTTP URI (via proxy)

This rule detects command and control traffic from the Anchor DNS variant of TrickBot which prefixes its registration and task URIs with the /anchor_dns/ path. The bot embeds the victim hostname and hardware identifier within this path during check in. The literal /anchor_dns/ marker is a strong indicator of Anchor activity.

Possible SPECTRALVIPER C2 Communication via Crafted Consent Cookie Values

This rule detects HTTP requests whose Cookie header simultaneously carries the euconsent-v2 and zd_cs_pm values used by the SPECTRALVIPER backdoor to smuggle command-and-control host information. The technique is tied to the OceanLotus (APT32) espionage campaign that masquerades C2 metadata inside cookies resembling GDPR consent and support tracking tokens. Identifying this combined cookie pattern matters because it exposes encrypted C2 traffic hidden inside otherwise benign-looking web requests.

Malicious Winter Vivern C2 Endpoint saveMessage via Proxy (via proxy)

This rule detects outbound HTTP requests to the /controlserver/saveMessage endpoint, the command-and-control path used by Winter Vivern after exploiting the CVE-2023-5631 Roundcube Webmail zero-day. Traffic to this endpoint indicates exfiltration of stolen webmail data to the group's C2 server.